Do Shareholders Care about “Surprise” Internal Control Weakness Disclosures?

Some prior studies have shown that many of the material weaknesses in internal control (MWs) disclosed at the year-end were “surprise” disclosures—i.e., the MW disclosures occurred only at the year-end (in Sarbanes-Oxley Act of 2002 [SOX] Section 404 reports) without any such disclosure in the prior quarterly filings (in SOX Section 302 reports) for the same fiscal year (Hermanson and Ye 2009; Munsif, Raghunandan, and Rama 2013; Belina and Rama 2022; U.S. House of Representatives 2002). In this study, we examine if shareholders’ reactions differ based on whether or not the MW disclosure is a surprise disclosure. We use shareholder voting on auditor ratification as our measure of shareholder reactions to surprise versus no-surprise MW disclosures.¹

Section 404 of the SOX specified that the SEC issue rules requiring that annual financial statements of SEC registrants include a management report on internal control (404(a)) and an opinion by auditors on such management reporting (404(b)). After SEC rulemaking, accelerated filers became subject to both sections for fiscal years ending on or after November 15, 2004, whereas nonaccelerated filers became subject only to Section 404(a) for fiscal years ending on or after December 15, 2007. Section 404 reports are included in annual 10-K filings with the SEC.

Section 302 of SOX requires that the CEO and chief financial officer (CFO) certify the effectiveness of disclosure controls and material changes in internal controls over financial reporting. Section 302 certifications must be included in quarterly 10-Q filings with the SEC.

Although there are differences between Sections 302 and 404, the Securities and Exchange Commission (SEC) (2003) notes that “there is substantial overlap between internal control over financial reporting and disclosure controls and procedures.”² The Securities and Exchange Commission (SEC) (2007) states that filers should “carefully consider” whether MWs discovered as part of their Section 404 testing should be disclosed under Section 302 in interim periods. Financial statement users view the Section 302 rules as requiring prior disclosure about MWs in quarterly Section 302 certifications before such disclosure in the year-end Section 404 filings (Glass Lewis & Co. 2005; Steinberg 2005).

Although Hermanson and Ye (2009) and Munsif et al. (2013) examine only the initial years of Section 404 reporting, Belina and Rama (2022) show that surprise MWs constitute the majority of the year-end MW disclosures as late as 2019.³ Surprise MW disclosure refers to MW disclosure that occurs only in the SOX Section 404 year-end report without any SOX Section 302 MW disclosure during the prior quarterly filings for the same fiscal year. Such disclosures are likely driven, among other factors, by the higher levels of auditor involvement in year-end work than that of the interim audit work.⁴

There are two different arguments on how surprise MW disclosures would affect shareholder perceptions about the auditors. One view holds that a surprise MW disclosure suggests that managers did not disclose the MW before the fiscal year-end—because of a lack of ability to detect or unwillingness to disclose—and that auditor’s involvement in year-end testing prompted the year-end disclosure of the MWs in internal control over financial reporting (ICFR). If shareholders attribute such MW disclosure to either the superior detection capability of the auditor and/or the independence of the auditor to force managers to disclose the MW, then shareholders should be happier (or, less dissatisfied) with the auditor after a surprise MW disclosure than with a no-surprise MW disclosure.

A counterargument, noted by Hermanson, Krishnan, and Ye (2009), is that “shareholders may blame the auditor for being partly responsible for the existence of material weaknesses (i.e., low audit quality).” Furthermore, even though 10-Q filings are unaudited, the SEC requires that auditors review quarterly results and 10-Q filings. Hence, investors may assign blame to the auditor for not ensuring early disclosure of the internal control problems in quarterly filings and a surprise MW disclosure after the fiscal year-end. Under this view, shareholders’ dissatisfaction with the auditor would be higher for the surprise MW disclosures.

In this study, we focus on one measure of shareholders’ perceptions about auditors. Shareholder voting on auditor ratification is an issue that has received significant interest from regulators (Mayhew 2017; Brown 2012), and prior research shows that perceptions about audit quality are reflected in shareholder votes related to auditor ratification (Dao, Raghunandan, and Rama 2012). Hence, we expect that shareholders’ dissatisfaction, as measured by shareholders voting not to ratify the auditor, would differ for companies with and without surprise MW disclosures. However, it is not clear which of the above two effects would dominate ex ante. Thus, our research question is:

The dependent variable in the above regression, VOTE, is the measure of shareholder dissatisfaction. Consistent with prior research (Dao, Mishra, and Raghunandan 2008; Hermanson et al. 2009; Barua, Raghunandan, and Rama 2017), we use the number of votes against or abstaining from auditor ratification as the numerator and the total number of votes cast as the denominator to calculate shareholder dissatisfaction and multiply the ratio by 100. Furthermore, again following prior research, given the skewness in the distribution of the vote proportion, we take the natural logarithm of the vote proportion to arrive at our dependent variable for the analysis, VOTE.

We examine the shareholder ratification votes that occur in the fiscal year after the initial MW disclosure. Since most shareholder votes occur during the second quarter of the fiscal year, most of the votes occur within four months of the 10-K filing disclosing the MW. SURP is our variable of interest and enables us to examine the difference between companies with no-surprise and surprise MW disclosures.

The other variables in the model are based on prior studies and control for financial and other characteristics shown to be associated with shareholder voting on auditor ratification (Dao et al. 2008; Hermanson et al. 2009; Barua et al. 2017; Tanyi and Roland 2017). The variables are defined in Table 1.

We obtain Section 302 and 404 data related to internal control and audit-related data (audit firm, audit fees, and opinions) for the years 2009 through 2019 from the Audit Analytics database. We obtain financial data from Compustat and institutional ownership data from Thomson Reuters Institutional Holdings (13F) database. We start with 1,333 observations of Section 404 opinions for accelerated and large accelerated filers with MW disclosures for the years 2009 through 2019.⁵ Consistent with prior research, we delete 62 observations of foreign companies and 178 financial sector observations. We then delete 41 observations with missing data for control variables. We restrict the analysis to observations that did not have an adverse Section 404 report in any of the prior two years, to ensure that our analysis is not contaminated by prior year MW disclosures. Thus, we also delete 422 observations with MW disclosures during the preceding two years. Based on the results of Feng, Li, Raghunandan, and Sun (2022), we also delete 127 observations with a subsequent restatement of the SOX 404 opinion.⁶ We also delete 89 observations with disclosures of “significant deficiencies” in Section 302 disclosures.⁷ Our final sample consists of 414 observations of which 101 are no-surprise MW disclosures and 313 are surprise MW disclosures.

Table 2 presents the descriptive statistics for the variables used in the regression model.⁸ The data show that there is a statistically significant difference (p < 0.10) between the surprise and no-surprise MW groups in terms of the shareholder vote measures (both raw and log-transformed). The results are consistent with the conjecture that shareholders partly blame the auditor for failing to detect and/or helping to correct internal control problems that end up as year-end surprise MW disclosures. However, this inference is based only on a univariate analysis that does not control for other factors that could potentially influence the VOTE measure.

The z-estimate results are mixed for the control variables used in the analysis; there are statistically significant (p < 0.10) differences between the surprise and no-surprise MW groups for auditor tenure (TENURE), restatement over the last three years (REST), Big 4 auditor (BIG4), and institutional ownership (INSTOWN). There are no statistically significant differences between the two groups in terms of log of assets (LNTA), going concern (GC), nonaudit fee ratio (NASR), or a bottom-line loss (LOSS).

Table 3 presents the regression results. The coefficient for SURP (0.358) indicates that shareholders at surprise MW disclosures companies are more likely (p < 0.05) to vote against or abstain from auditor ratification than shareholders at no-surprise MW disclosure companies. The value of 0.358 for the coefficient of SURP indicates that shareholder dissatisfaction at a company with a surprise MW disclosure is about 1.43 times the corresponding proportion at a company with no-surprise MW disclosure. Thus, the results indicate a strong association between surprise MW disclosures and shareholders’ dissatisfaction against auditors as measured by the proportion of votes against or abstaining from auditor ratification.

In our main analysis, we deleted surprise observations that (1) had significant deficiency (SD) disclosures or (2) restated the internal control report. We perform the following robustness tests. First, we include restated internal control issues and code them as surprise MW disclosures. Next, we include SD disclosures and code such observations as surprise MW disclosures. In the third analysis, we include the SD disclosures but code them as no-surprise MW disclosures. In such tests, the inference from our main analysis (namely, surprise MW disclosures elicit stronger shareholder reaction against auditor ratification) remains unchanged.

Previous studies have established that shareholders and investors appreciate the disclosures of bad news as soon as they are detected. Accordingly, timely disclosure of material weaknesses in internal control is of paramount importance.

Our results suggest that shareholders prefer an earlier disclosure of bad news such as the existence of material weaknesses in internal control. When companies delay such disclosure until the year-end, shareholders express their displeasure by being less likely to vote for auditor ratification. Of course, the proportions of shareholders voting not to ratify the auditor is low, namely, 2 percent in our sample. Yet, as noted by Dao et al. (2012) and Mayhew (2017), even minor changes in votes against auditor ratification often lead to substantive changes. For example, Barua et al. (2017) and Tanyi and Roland (2017) show that, even at very low levels of shareholder dissatisfaction, increases in such voting are associated with a significant increase in the likelihood of subsequent auditor dismissals.

More generally, if there is bad news, then shareholders would prefer that it is disclosed as soon as possible. Furthermore, shareholders may believe the auditors are partly responsible for failing to detect (and/or making clients disclose) internal control problems sooner. Hence, auditors may need to exercise greater professional skepticism about the operating effectiveness of internal controls even in quarterly reviews and push clients for earlier disclosure of internal control problems in their 10-Q filings. Furthermore, given the role of audit committees in the oversight of the financial reporting process, auditors may need to sensitize audit committee directors about the need for a timely disclosure of internal control problems.

As with any empirical research, there are some limitations in this study. We can observe only the disclosed MWs, and we do not know the actual number of MWs that should have been disclosed earlier in the fiscal year since we do not have access to the facts underlying the judgments of managers or the work papers of auditors. Furthermore, we cannot discern whether the dissatisfaction of the shareholders toward the auditors is due to the timing of MW disclosures. Thus, we can only speak to the association between delayed MW disclosures and shareholders’ dissatisfaction, not of any causation. Finally, an interesting issue for future research is to examine differences in the time taken to remediate surprise versus no-surprise MW disclosures.

NAVISTAR INTERNATIONAL CORP

10-Q for the period ended 31 July 2013 (filed on 4 September 2013)

Management’s Assessment of Disclosure Controls

The Company is in the process of reviewing this matter, including the adequacy and sufficiency of internal control over financial reporting as they relate to this matter.